Is this a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used?

Is this a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used?

Solution: mnt
A . Yes
B . No

View Answer

Answer: B

Explanation:

The mnt namespace is not disabled by default and does not need to be enabled at Docker engine runtime to be used. The mnt namespace is one of the six Linux kernel namespaces that Docker uses to isolate containers from the host system1. The mnt namespace allows a container to have its own set of mounted filesystems and root directories, which are different from the host’s2. This means that a container can access only the files and directories that are mounted inside its namespace, and not the ones that are mounted on the host or other containers. The mnt namespace is created automatically when a container is started, and it is destroyed when the container stops3.

Reference: Isolate containers with a user namespace | Docker Docs

The mnt namespace – Docker Cookbook – Second Edition

Container security fundamentals part 2: Isolation & namespaces

mnt is not a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. According to the official documentation, mnt is one of the namespaces that are enabled by default when using namespaces for isolation.

Reference: https://docs.docker.com/engine/security/userns-remap/#user-namespace-known-limitations